At present, microchip cards are liable to suffer different types of fraud.
A first type of fraud consists in duplicating the card without authorization, the term “cloning” often being used to characterize this operation.
A second type of fraud consists in modifying the data attached to a card, in particular the amount of credit written in the memory of the card.
Cryptography is used to combat these types of fraud, both to authenticate the card by means of an authentication algorithm and/or to authenticate the data by means of a digital signature, and also, where appropriate, to ensure the confidentiality of the data by means of encryption.
Cryptography employs two entities which, for authentication, consist in a verifier entity and in an object to be authenticated. The cryptography may be either symmetrical or asymmetrical.
With symmetrical cryptography, also known as secret key cryptography, both entities share exactly the same information, in particular said secret key.
With asymmetrical, or public key, cryptography, one of the entities, the entity to be authenticated, holds a pair of keys, one of which is private and the other public; there is therefore no shared secret key.
The first authentication mechanisms to be developed for symmetrical cryptography consist in calculating once and for all an authentication value that is different for each card, storing it in the memory of the card, reading it on each transaction, and verifying it by interrogating an application of the network supporting the transaction in which authentication values that have already been assigned are either stored or recalculated. However, those mechanisms provide insufficient protection because the authentication value can be intercepted, reproduced, and replayed fraudulently as it is always the same for a given card, thus enabling a clone of the card to be produced. To combat cloning, passive card authentication mechanisms are replaced by active authentication mechanisms that can also ensure the integrity of the data.
The general principle of symmetrical active authentication mechanisms is as follows: at the time of authentication, the electronic chip and the application calculate an authentication value that is the result of applying a function to a list of arguments determined for each authentication. That list of arguments may include a random challenge defined by the application on each authentication, data contained in the electronic chip, and a secret key known to the electronic chip and the application. If the authentication value calculated by the electronic chip is identical to the authentication value calculated by the application, the electronic chip is deemed to be authentic and the transaction between the chip and the application is authorized.
However, secret key mechanisms require the verification devices for authenticating the chip, such as those present in a public telephone network, an electronic payment terminal, or a public transport turnstile, to know the secret key held by said chip. There is then a major drawback in that, if said device is required to be able to authenticate any chip issued in relation to the application, it must either store the secret keys of all the chips, or else it must store a base key for working out the secret key of any chip, known as a mother key or master key. Either way, each device stores sufficient information to be able to work out the secret keys of all the chips issued and therefore stores sufficient information to be able to clone any of them. It follows that successful hacking of any of the verification devices would entirely destroy the security of the application.
Thus solutions based on public key cryptography may be preferred over secret key mechanisms. The principle of public key authentication mechanisms is as follows: the chip seeking to be authenticated calculates values depending on its private key, associated with its public key, and any random parameters. The application then verifies that the values calculated by the chip are consistent without needing to know the private key of the chip. Only the public key of the chip is needed, together with other non-secret parameters.
The best-known solutions for producing such mechanisms are generally based on mathematical problems that are difficult to solve, such as factorization and the discrete logarithm. Moreover, implementing these problems generates modular exponentiation calculations, i.e. calculations of the type xe mod n where mod denotes the modular reduction mathematical function. This type of calculation is a priori the most complex operation that can be carried out in a reasonable time without making any assumptions as to calculation power.
Bilinear applications, well known to mathematicians, have entered the field of cryptography in the past few years.
Consider, for example, an application f defined on the set G1×G2 in G, where G1, G2 and G are cyclic groups. If g1 and g2 are generators of G1 and G2, respectively, the application f is known as a bilinear application of G1×G2 in G if:f(g1a,g2b)=[f(g1, g2)]ab.
However, the current problem linked to bilinear applications is that their evaluation generates very large volumes of calculations that are much more complex than those involved in a modular exponentiation calculation, for example. Hence the impossibility of implementing such calculations at present in the context of the applications envisaged.